INC Ransomware: Defending Against the 2026 Prolific RaaS Surge

---
title: INC Ransomware Prep - Shadow Copy Deletion
id: 92a3f1c8-1b4d-4d67-bc12-3e5a8f901234
status: experimental
description: Detects attempts to delete Volume Shadow Copies, a common step taken by INC ransomware to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  condition: selection
falsepositives:
  - Legitimate system administration tasks
level: high
---
title: INC Ransomware Prep - System Log Clearing
id: 82b4e1c9-2c5d-4e12-ac34-4f6b9g012345
status: experimental
description: Detects the use of wevtutil to clear system logs, often performed by ransomware operators to hide tracks.
references:
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains: 'cl'
  condition: selection
falsepositives:
  - Admin scripts clearing logs for space
level: medium
---
title: INC Ransomware - BCD Recovery Modification
id: 73c5d2a0-3d6e-5f23-bd45-5g7c0h123456
status: experimental
description: Detects modification of boot configuration to disable recovery, a tactic observed in INC encryptors.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/06/18
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection
falsepositives:
  - Rare administrative boot configuration changes
level: high

// Hunt for ransomware precursor activities: Shadow Copy Deletion
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessVersionInfoOriginalFileName in ("vssadmin.exe", "wmic.exe") or FileName in ("vssadmin.exe", "wmic.exe"))
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend TS = 1

-- Hunt for suspicious ransomware precursor processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "vssadmin" 
   AND CommandLine =~ "delete"
   OR Name =~ "wevtutil" 
   AND CommandLine =~ "cl"

# INC Ransomware Hardening Script
# Run this on critical endpoints to verify recovery mechanisms are active

Write-Host "Checking System Recovery Configuration..." -ForegroundColor Cyan

# 1. Check if VSS Service is Running
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne 'Running') {
    Write-Host "[WARNING] Volume Shadow Copy Service is not Running. Start it manually." -ForegroundColor Red
} else {
    Write-Host "[OK] Volume Shadow Copy Service is Running." -ForegroundColor Green
}

# 2. Check recent Shadow Copies (Ensure they exist)
try {
    $shadows = vssadmin list shadows
    if ($shadows -match "No shadow copies") {
        Write-Host "[WARNING] No Shadow Copies found. System is vulnerable to data loss." -ForegroundColor Red
    } else {
        Write-Host "[OK] Shadow Copies exist." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query VSS." -ForegroundColor Red
}

# 3. Check for 'recoveryenabled' status (simple check)
$bcdStatus = bcdedit /enum | Select-String "recoveryenabled"
if ($bcdStatus -like "*no*") {
    Write-Host "[CRITICAL] Boot Recovery is DISABLED. Re-enable immediately using: bcdedit /set {default} recoveryenabled yes" -ForegroundColor Red
} else {
    Write-Host "[OK] Boot Recovery appears enabled." -ForegroundColor Green
}

Write-Host "Remediation check complete."